Does OAuth always use the HTTP Authorization header?

Question

Have an app running in GCP using App Engine and secured by IAP. To the best of my knowledge IAP uses OAuth, but when I open the app in the browser and inspect the outgoing XHR requests I don't see the HTTP Authorization header on any of them. There does appear to be a token in the cookies though, something named GCP_IAAP_AUTH_TOKEN. Just wondering if this is still considered OAuth or is it some other form of authentication?

Answer 1

Cloud IAP can use either the cookie GCP_IAAP_AUTH_TOKEN or Authorization: Bearer. Both are derived from OAuth2.

The credential that Cloud IAP relies on is an OpenID Connect (OIDC) token. That token can come from either a cookie GCP_IAAP_AUTH_TOKEN or an Authorization: bearer header.

Authenticating with OpenID Connect